# SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58 Million Connection Logs, 23.4M User Records

> A threat actor using the handle "vhacker51" listed a 17 GB SQL database (compressed ~5 GB) allegedly stolen from SplitVPN, a Russian VPN service formerly branded NotVPN, on the Altenen cybercrime forum on July 21, 2026. Independently verified by Mysterium Network's research team, the dump contains roughly 23.4 million user records, 13.6 million device records, 2.6 million Tinkoff payment records, and nearly 58 million device-to-server connection logs (June 2025-July 21, 2026) that directly contradict SplitVPN's "no logs or history" marketing claim; Have I Been Pwned added the breach on August 1, 2026, confirming 865,336 unique affected email addresses.

- **Published:** 2026-08-02T00:00:00Z
- **Last reviewed:** 2026-08-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1823
- **ID:** TL-2026-1823
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SplitVPN, a Russian VPN service marketed for bypassing internet censorship and rebranded from its earlier NotVPN identity (Android package names com.notvpn and com.notvpn2 still reference the legacy brand), advertises a strict "No logs or history: We never store your activity or connection logs" policy. On July 21, 2026, a forum actor operating under the handle "vhacker51" began distributing a 17 GB SQL database (approximately 5 GB compressed, with a public download link) on the Altenen cybercrime/carding forum, claiming the data was stolen directly from SplitVPN's backend infrastructure.

The listing advertised roughly 23.4 million user records, 13.6 million device records, 23.9 million authorization records, 2.6 million Tinkoff payment records, and nearly 58 million device-to-server connection log entries. Security researchers at Mysterium Network obtained a copy of the dump and verified it against the raw data, confirming the counts. The exposed dataset spans email addresses, last-seen IP addresses, countries of residence, approximate geographic locations, device identifiers/hardware IDs, subscription status, recurring-billing tokens issued via the Tinkoff payment gateway, masked card data (BIN plus last four digits and expiry date, not full PANs), transaction amounts and timestamps, authentication tokens, proxy targets, WireGuard peer data, linked Telegram account identifiers, linked Apple ID identifiers, server metrics, internal back-office/App Store provisioning infrastructure tables, and administrator records.

The most damaging element is the `deviceProxy` table: nearly 58 million rows recording which device connected to which VPN server and exactly when, with timestamps running from June 2025 through July 21, 2026 (the apparent breach cutoff date). This table does not record destination websites visited, but device-to-server connection metadata at this granularity is precisely the category of record SplitVPN's marketing promised never to retain, and it is sufficient to support timing-correlation and de-anonymization analysis against a censorship-circumvention user base concentrated in Russia, Iran, India, and Myanmar -- jurisdictions where VPN use itself can carry legal or personal-safety risk.

The `admin` table exposed five named operator accounts (pavel, valerii, maria, andrei, vladislav) with bcrypt password hashes, assigned roles, and action logs; these accounts were created between January and June 2026, suggesting relatively recent administrative infrastructure. Have I Been Pwned ingested the breach on August 1, 2026 and confirmed 865,336 unique email addresses in its consumer-facing notification dataset -- a smaller figure than the seller's full 23.4 million user-record claim, consistent with HIBP typically indexing only the unique-email subset of a larger raw dump. As of the initial reporting, SplitVPN had not publicly confirmed the incident.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1590 Gather Victim Network Information
- T1591 Gather Victim Org Information
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1586 Compromise Accounts
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1078 Valid Accounts
- T1087 Account Discovery
- T1657 Financial Theft

## Sources

- [A 'no-logs' VPN that kept 58 million connection logs: inside the NotVPN/SplitVPN breach](https://databreaches.net/2026/08/02/a-no-logs-vpn-that-kept-58-million-connection-logs-inside-the-notvpn-splitvpn-breach/)
- [VPN Breach Exposes 58 Million Connection Logs Despite "No-Logs" Claims](https://securityaffairs.com/196197/security/vpn-breach-exposes-58-million-connection-logs-despite-no-logs-claims.html)
- [SplitVPN breach reveals 58 million hidden connection logs](https://www.bitdefender.com/en-us/blog/hotforsecurity/splitvpn-breach-58-million-connection-logs)
- [SplitVPN 'no logs' claim contradicted by massive data leak](https://www.scworld.com/brief/splitvpn-no-logs-claim-contradicted-by-massive-data-leak)
- [SplitVPN Data Breach Exposes 865k Users' Personal Records](https://cybersecuritynews.com/splitvpn-data-breach/)
- [Have I Been Pwned: SplitVPN Data Breach](https://haveibeenpwned.com/Breach/SplitVPN)
- [SplitVPN - 865,336 breached accounts](https://www.redpacketsecurity.com/splitvpn-865-336-breached-accounts/)
- [Dark Web Informer: SplitVPN user, device, and connection logs allegedly leaked](https://x.com/DarkWebInformer/status/2079984367514923337)
- [Questa VPN prometteva massima sicurezza ma conservava 58 milioni di log ora sul dark web](https://tech.everyeye.it/notizie/vpn-prometteva-massima-sicurezza-conservava-58-milioni-log-dark-web-893410.html)
- [SplitVPN unlimited fast VPN - App Store](https://apps.apple.com/us/app/splitvpn-unlimited-fast-vpn/id6755629713)
- [SplitVPN - Secure VPN Proxy - Google Play](https://play.google.com/store/apps/details?id=com.notvpn2&hl=en)
- [NotVPN - Unlimited VPN - Google Play](https://play.google.com/store/apps/details?id=com.notvpn)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1823